CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2023-20198: 
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.

Affected products: Cisco Cisco IOS XE Software
CWE: CWE-420 Unprotected Alternate Channel
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1136
ATT&CK techniques (all): T1136, T1190
CVE-2018-2893: 
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products: Oracle Corporation WebLogic Server
CWE: Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
ATT&CK techniques (all): T1190
CVE-2018-0296: 
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.

Affected products: Cisco Adaptive Security Appliance unknown
CWE: CWE-20
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ATT&CK exploitation technique(s): T1202
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1202
CVE-2016-5645: 
Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP community, which makes it easier for remote attackers to load arbitrary firmware updates by leveraging knowledge of this community.

CWE: CWE-798 Use of Hard-coded Credentials
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
ATT&CK techniques (all): T1078, T1542.001
CVE-2023-20118: 
A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device.
 This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device.
 Cisco has not and will not release software updates that address this vulnerability.   However, administrators may disable the affected feature as described in the Workarounds ["#workarounds"] section.
  {{value}} ["%7b%7bvalue%7d%7d"])}]]

Affected products: Cisco Cisco Small Business RV Series Router Firmware
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
ATT&CK exploitation technique(s): T1068, T1078
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1505.003
ATT&CK techniques (all): T1059, T1068, T1078, T1505.003
CVE-2023-43770: 
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Affected products: roundcube webmail, debian debian_linux
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
ATT&CK exploitation technique(s): T1189
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1082
ATT&CK techniques (all): T1059, T1082, T1189
CVE-2020-5366: 
Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files.

Affected products: Dell Integrated Dell Remote Access Controller (iDRAC)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1190
CVE-2020-16874: Visual Studio Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted file with an affected version of Visual Studio.</p>
<p>The update addresses the vulnerability by correcting how Visual Studio handles objects in memory.</p>

Affected products: Microsoft Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6), Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Microsoft Visual Studio 2019 version 16.0, Microsoft Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3), Microsoft Microsoft Visual Studio 2012 Update 5, Microsoft Microsoft Visual Studio 2013 Update 5, Microsoft Microsoft Visual Studio 2015 Update 3
CWE: Remote Code Execution
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
ATT&CK exploitation technique(s): T1204.002
ATT&CK primary impact: T1499.004, T1574
ATT&CK secondary impact: T1005, T1136, T1485, T1565
ATT&CK techniques (all): T1005, T1136, T1204.002, T1485, T1499.004, T1565, T1574
CVE-2018-15795: CredHub Service Broker uses guessable client secret
Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.

Affected products: Pivotal Cloud Foundry CredHub Service Broker
CWE: Predictability problems
CVSS: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
ATT&CK exploitation technique(s): T1110
ATT&CK primary impact: T1078
ATT&CK techniques (all): T1078, T1110
CVE-2017-0213: 
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.

Affected products: Microsoft Corporation Windows COM
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1068, T1211
CVE-2023-33246: Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. 

Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. 

To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

Affected products: Apache Software Foundation Apache RocketMQ
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1608.001
ATT&CK techniques (all): T1059, T1190, T1608.001
CVE-2022-35405: 
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

CWE: CWE-502 Deserialization of Untrusted Data
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1059
ATT&CK techniques (all): T1059
CVE-2020-3379: Cisco SD-WAN Solution Software Privilege Escalation Vulnerability
A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain administrative privileges.

Affected products: Cisco Cisco SD-WAN Solution
CWE: CWE-264
CVSS: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1608
ATT&CK techniques (all): T1078, T1608
CVE-2014-4114: 
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1059, T1068, T1211
CVE-2018-18667: 
The mintToken function of Pylon (PYLNT) aka PylonToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value, a related issue to CVE-2018-11812.

ATT&CK techniques (all): T1565
CVE-2015-2945: 
mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015.

ATT&CK techniques (all): T1059, T1068
CVE-2019-13541: 
In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. This may allow an attacker to access information and remotely execute arbitrary code.

Affected products: Horner Automation Cscape
CWE: CWE-20 IMPROPER INPUT VALIDATION CWE-20
ATT&CK techniques (all): T1203, T1204.002
CVE-2023-35078: 
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

Affected products: Ivanti Endpoint Manager Mobile, ivanti endpoint_manager_mobile
CWE: CWE-287 Improper Authentication
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1136, T1213
ATT&CK techniques (all): T1136, T1190, T1213
CVE-2020-11010: SQL injection in Tortoise ORM
In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).

Affected products: tortoise tortoise-orm
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1005, T1136, T1190, T1505.003, T1565.001
ATT&CK techniques (all): T1005, T1059, T1133, T1136, T1190, T1505.003, T1565.001
CVE-2019-1579: 
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

Affected products: Palo Alto Networks GlobalProtect Portal/Gateway Interface
CWE: Remote Code Execution, CWE-134 Use of Externally-Controlled Format String
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1203
CVE-2021-22017: 
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

Affected products: VMware vCenter Server, VMware Cloud Foundation
CWE: Rhttpproxy bypass vulnerability, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1090.001
ATT&CK techniques (all): T1090.001, T1190
CVE-2015-2546: 
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.

CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
ATT&CK techniques (all): T1608
CVE-2018-11051: RSA Certificate Manager Path Traversal Vulnerability
RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.

Affected products: RSA Certificate Manager Path Traversal Vulnerability
CWE: Authentication Bypass Vulnerability
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1190
CVE-2018-9862: 
util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd line, and then issuing a "docker exec" command with that value in the -u argument, a similar issue to CVE-2016-3697.

ATT&CK techniques (all): T1068
CVE-2012-0181: 
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly manage Keyboard Layout files, which allows local users to gain privileges via a crafted application, aka "Keyboard Layout File Vulnerability."

ATT&CK techniques (all): T1068
CVE-2018-15454: Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service Vulnerability
A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to specifically trigger this issue at a high rate across an affected device. Software updates that address this vulnerability are not yet available.

Affected products: Cisco Cisco Adaptive Security Appliance (ASA) Software
CWE: CWE-20
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
ATT&CK techniques (all): T1499.004
CVE-2025-21418: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Affected products: Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)
CWE: CWE-122: Heap-based Buffer Overflow
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1005, T1055
ATT&CK techniques (all): T1005, T1055, T1068
CVE-2018-20753: 
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1212
CVE-2025-22226: 
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

Affected products: ESXi, VMware Workstation, VMware Fusion, VMware Cloud Foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure
CWE: Information disclosure vulnerability, CWE-125 Out-of-bounds Read
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
ATT&CK primary impact: T1005
ATT&CK secondary impact: T1611
ATT&CK techniques (all): T1005, T1611
CVE-2022-26501: 
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

CWE: CWE-306 Missing Authentication for Critical Function
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1036, T1048
ATT&CK techniques (all): T1036, T1048, T1059, T1190
CVE-2023-27532: 
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

Affected products: Veeam Backup & Replication
CWE: CWE-306 Missing Authentication for Critical Function (CWE-306)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ATT&CK exploitation technique(s): T1133
ATT&CK primary impact: T1059.003
ATT&CK secondary impact: T1087, T1087.001, T1486, T1555
ATT&CK techniques (all): T1059.003, T1087, T1087.001, T1133, T1486, T1555
CVE-2019-1764: Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.

Affected products: Cisco Cisco Wireless IP Phone 8821 and 8821-EX, Cisco Cisco IP Conference Phone 8832 and the rest of the IP Phone 8800 Series
CWE: CWE-352
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068, T1204.001